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ABSTRACT. We introduce a nominal actor-based language and study its expressive power. 
We have identified the presence/absence of fields as a crucial feature: the dynamic creation 
of names in combination with fields gives rise to Turing completeness. On the other hand, 
restricting to stateless actors gives rise to systems for which properties such as termination 
are decidable. This decidability result still holds for actors with states when the number 
of actors is bounded and the state is read-only. 


1. INTRODUCTION 


Since their introduction in |20|, actor languages have evolved as a powerful computational 
model for defining distributed and concurrent systems [2] [3]. Languages based on actors 
have been also designed for modelling embedded systems [24], wireless sensor networks 
[31], multi-core programming [22], and web services [9] [10]. The underlying concurrent 
model of actor languages also forms the basis of the programming languages Erlang [4] and 
Scala that have recently gained in popularity, in part due to their support for scalable 
concurrency. 
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In actor languages [32], actors use a queue for storing the invocations to their 
methods in a FIFO manner. The queued invocations are processed sequentially by executing 
the corresponding method bodies. The encapsulated memory of an actor is represented by a 
finite number of fields that can be read and set by its methods and as such exist throughout 
its life time. 

In this paper we introduce a nominal actor-based language and study its expressive 
power. This language, besides dynamic creation of actors, also supports the dynamic cre- 
ation of variable names that can be stored in fields and communicated in method calls. As 
such our nominal actor-based language gives rise to unboundedness in (1) internal queues 
of the actors, (2) dynamic actor creation/activation and (3) dynamic creation of variable 
names. 

Statelessness has recently been adopted as a basic principle of service oriented com- 
puting, in particular by RESTful services. Such services are designed to be stateless, and 
contextual information should be added to messages, so a service can customize replies sim- 
ply by looking at the received request messages. In service oriented computing read-only 
fields (which are initialized upon activation) are used to provide configuration/deployment 
information that distinguishes the distinct instances of the same service. We have identified 
the presence/absence of fields as a crucial feature of our language: (1) and (3) in combina- 
tion with fields gives rise to a Turing complete calculus. On the other hand, restricting to 
stateless actors gives rise to systems for which properties such as termination and process 
reachability are decidable. In order to preserve this decidability result to actors with states 
we have to restrict the number of actors to be finite and the state to be read-only. 

More specifically, we model a system consisting of finitely many actors with read-only 
fields as a well-structured transition system — henceforth termination and process reach- 
ability are decidable. Further, we show that an abstraction of systems of unboundedly many 
stateless actors (i.e., actors without fields) which preserves termination and process reach- 
ability is also an instance of well-structured transition system. It turns out that, in the 
context of unbounded actor creation, this restriction to stateless actors is necessary by a 
reduction to the halting problem for 2 Counter Machines. 

To the best of our knowledge, the technique we use to establish the decidability results 
for the above languages is original since (7) these systems respectively admit the creation of 
unboundedly many variables and actor names; (ii) actors in general are sensitive to the iden- 
tity of names because of the presence of a name-match operator. In particular, in the case 
of finitely many actors with read-only fields, we define an equivalence on process instances 
in terms of renamings of the variables that generate the same partition. This equivalence 
allows us to compute an upper bound to the instances of method bodies, which is the basic 
argument for the model being a well-structured transition system. In case of systems with 
unboundedly many stateless actors, the reasonable extensions of this equivalence on process 
instances have been unsuccessful because of the required abstraction of the identity of actor 
names. Therefore we decided to apply our arguments to an abstract operational model 
where messages may be enqueued in every actor of the same class. The above equivalence 
can be successfully used in this model, thus yielding again the upper bounds for the number 
of method body instances. Further, the abstract model still provides enough information 
to derive decidable properties of the language. 


Related Works. There exists a vast body of related work on decidability of infinite-state 
systems (see [1]). However, to the best of our knowledge, the specific characteristics of the 
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pure asynchronous mechanism of queued and dequeued method calls in actor-based lan- 
guages has not been addressed. It is interesting to observe that the most expressive known 
fragment of the pi-calculus for which interesting verification problems are still decidable is 
the depth-bounded fragment [26]. In the theory of well-structured transition systems 
is applied to prove the decidability of coverability problems for bounded depth pi-calculus. 
Our nominal actor language also features the creation and communication of new names. In 
our decidable fragments however, differently from the depth-bounded pi-calculus fragment, 
we do not restrict the creation and communication of names. For instance, in the queue of 
an actor we might have unboundedly many messages (representing process continuations) 
where each message shares one name with the previous message in the queue. Decidability 
of asynchronous communication via a shared data space, read operation and non-blocking 
test operators on the shared space of the coordination language Linda has been studied 
in [8]. In [5] the authors introduce an algorithm for reachability analysis of multithreaded 
object-oriented programs. This algorithm requires both a bound on the number of context 
switches (between the threads) and the visible heap. Further their approach is specific to 
object-oriented programs and is not applicable to actor-based languages, which are based 
on a different concurrency model. As another final example, a system composed of finitely 
many actors can be easily modeled as a communicating finite state machine [6], a formalism 
that is known to be Turing complete [6] [25]. However, this modelling does not scale to infi- 
nite actors and does not display the execution model of actors. Recent work on actor-based 
language focusses on deadlock analysis: In [18], a technique for the deadlock analysis has 
been introduced for a version of Featherweight Java which features asynchronous method 
invocations and a synchronization mechanism based on futures variables. The approach fol- 
lowed in for detecting deadlock in an actor-like subset of Creol [7] is based on suitable 
over-approximations. 


2. THE LANGUAGE Actor 


Four disjoint infinite sets of names are used: actor classes, ranged over by C, D, ---, method 
names, ranged over by m, m/, n, n', --- , field names, ranged over by f, g, --- , and variables, 
ranged over by x, y, z, :--. For notational convenience, we use x when we refer to a list of 
variables z1,...,2c; (and similarly for other kinds of terms). 

'The syntax of the language Actor uses expressions E and processes P defined by the 
rules 


| z | newC(E) 
o | €44 E),P | 1etz—EinP | zim(E)P | 
[E=E|P;P | P+P 


An expression £ either denotes a value stored in a field f, or a variable x, or a new actor 


| 
Hh 


E 
P 


of class C with fields initialized to the values of E. A process may be either the terminated 
one, denoted by 0, or a field update (f <4 E). P, or the assignment let x = E in P 
of a value to a variable, or an invocation z!m(£E). P of a method m of the actor x with 
arguments E, or a check [E = E'|P; P' of the identity of expressions with positive and 
negative continuations, or, finally a nondeterministic process P 4- P'. We never write the 
tailing O in processes; for example (f <4 r).0 will be always shortened into (f <4 2). We 
will also shorten [E = E']P; 0 into [E = E']P. Following the tradition of process calculi like 


CCS [27], we model sequences of actions by exploiting the so-called prefix notation (like, 
e.g., in (f | E).P). 

The operation let x = E in P is a binder of the occurrences of the variable x in the 
process P that are not already bound by a nested let operation of x; the occurrences of 
x in E are free. Let free(P) be the set of variables of P that are not bound. As usual, 
we identify processes P and P’ that are equal up-to alpha-conversion of bound names, 
written P =, P'. The substitution operation P[V/,] returns the process P where the free 
occurrences of x are replaced by y. The substitution operation P[¥/;] returns the process P 
where the free occurrences of © are simultaneously replaced by y. In case, alpha-renaming is 
required for avoiding name clashes. For example let z = x in new C(y, z) |: "/.. y] returns 
let z’ = z in new C(u, 7). 


In the following examples and encodings we shorten let x = f in r!m(E).P into 
£!m(E).P (we have preferred the simpler syntax to ease the descriptions). 

A program is a main process P and a finite set of actor class definitions C.m(£) = Pom, 
where Pem may contain the special variable this (which can be seen as an implicit formal 
parameter of each method). In the following we restrict to programs that are 
(1) unambiguous, namely, every pair C, m has at most one definition; 

(2) correct, namely, let fields(-) be a map that associates a tuple of field names to every 
actor class. Then, (i) in every expression new C(E), the length of the tuples E and 
fields(C) are the same; (ii) in every definition C. m(z) = Pom, the field names occurring 
in Pom are in the tuple fields(C). 

In this paper, we abstract from types and type-correctness because we are only interested 

in expressive power issues. However, it is straightforward to equip the above language with 

a type discipline. 


2.1. Examples. To illustrate the features of the actor language we discuss four examples. 


Example 2.1. The merger service is an application that forwards to a back office server 
the values carried by two invocations of clients to methods first and second. The merger 
freezes the forward as long as there is no invocation of either first or second — in the process 
calculi community, the merger is modelled by a join pattern [17]. In our actor language the 
merger is modelled by a class actor Merger with six fields: t and f storing the values true 
and false, respectively; fst and snd storing true or false according to the method first and 
second have been invoked or not, respectively; g storing the argument of the invocation; 
srv storing the actor name of the back office server. 
'The class actor Merger includes the following three methods: 


Merger.init(r) = (t4 t).(f a ff).(fst e jff).(snd e ff).(srv e xc) 


Merger. first(a) = [snd = t] srv! m(a, g). (snd 4 f); 
[fst =f] (fst 4 t).(g a a); this! first(a) 


Merger. second(a) = [fst = t| srv! m(g,a). (fst 4 f); 
[snd = f] (snd 4 t).(g €x a); this! second(a) 
The method init manifests a basic feature of our actor language: the creation of new 
variables. In particular, # and ff are free variables in the method definition of init. When 
init will be invoked, they will be replaced by two different fresh variables (said in pi-calculus 
jargon [28], we are assuming an implicit (v tt, ff)- at the beginning of the method body). 
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These variables are stored in the fields t and f, respectively and they will be used to update 
the fields fst and snd appropriately . The merger forwards two messages to the server, 
which is stored in the field srv. These messages have been received through invocations of 
first and. second. No forward occurs if one of the two methods has not been invoked. In 
particular, first (the method second behaves in a similar way) performs the forward if second 
has been evaluated and its message has not been already forwarded (field snd equal to tt); 
in this case the parameter of the invocation of second has been stored into g. Otherwise, 
if there is no previous invocation to first, still to be forwarded, (field fst equal to ff) then 
fst is set to # and the parameter stored into g. There is a possibility that first is evaluated 
and a previous evaluation of first has still to be forwarded (field fst equal to t). In this 
case, the invocation is bounced back (it is enqueued in the actor queue — see the operational 
semantics). 


Example 2.2. As a second example we model the OpenID authentication protocol [30]. 
Three actors are considered: a client, a server, and an authProvider. The client sends 
a login request to the server. The server generates two secure tokens clientToken and 
auth Token, used for secure communication with the client and the auth. Provider, respectively, 
and then sends the two tokens to the corresponding actors. Subsequently, the client sends 
an authentication message to the authProvider that (after checking the correctness of the 
username and password) communicates to the server whether the authentication succeeds 
or fails. In the following, we abstract from the management of username and password and 
we simply assume that they are stored in the fields u and p of the client when it sends the 
authenticate message to the authServer. 

The class C of the client includes the following two definitions: 

C.init(server) =  server!login(this) 
C. token(authServer, clientToken) = authServer ! authenticate(u, p, client Token) 


The class S of the server includes the following four definitions: 


S.init(authServer) = (auth €» authServer) 
S.login(client) = auth! open(this, clientToken, authToken) . 
client ! token(auth, auth Token) 


S. succeeds(auth Token) 
S.fails(auth Token) = 


The class A of the authServer includes the following two definitions (we leave unspecified 
the check of the correctness of username and password): 


A.open(server, cToken, aToken) = (server €» server).(ctoken <4 cToken). 
(atoken <4 aToken) 
A. authenticate(u,p, cToken) = [ctoken = cToken| server! succeeds(atoken); 


server! fails(atoken) 


The main program that instantiates the client, the server and the authProvider is as 


follows: 
let client = new C in 


let server = new S in 
let authProvider = new A in 
client ! init(server) . server ! init(authProvider) 


Example 2.3. We illustrate the modeling of a register that stores natural numbers and 
supports the operations of increment and decrement, when its value is positive. In the 
absence of data-types in our nominal actor language, we model a register by an actor 
and implement the value of the register by the number of invocations of the method item 
stored in its queue. Below we describe the corresponding class R, assuming a class Ctrl 
which encodes the control of the register machine. When an operation is performed, the 
register replies with an invocation run(pc, tt, ff), where pc is a suitable continuation. The 
continuation is unique when the increment is invoked; the decrement has two possible 
continuations: a positive one, in case of success, and a negative one (the register was 0, no 
decrement is performed). 


// R has a field called dec, Ctrl is an actor in the context 


R.dec(pc, pe’, tt, ff) = (dec € tt). R! checkzero(pc, pc’, tt, ff) 
R.checkzero(pc, pc’, tt, ff) = [dec = tt] Ctrl! run(pc’, tt, ff). (dec ff); Ctrl! run(pc, tt, ff) 
R.init(tt,ff) = (dec 4 ff) 
R.item(tt, ff) = [dec = ff | R item(t, ff); (dec — ff) 


Method inc simply gives rise to the storage of a new message item and a trigger of the 
continuation. Executing a message item, amounts to bouncing the invocation back if the 
value of the field dec is false. In this case the invocation is enqueued again. Otherwise the 
invocations is *consumed" because there was a pending decrement to perform (see below) 
and dec is set to true (indicating that there is no pending decrement anymore). Method dec 
is the tricky one: it sets dec to true and add an invocation of checkzero (we are assuming 
that the register queue always contains at most one invocation of dec). That is, we are 
postponing the triggering of the continuation to the evaluation of checkzero that will occur 
after the evaluation of any other method in the queue of the register. When checkzero will 
be evaluated either (i) the dec field is true, this means that the register did not contained 
any item message — its value was 0 — and the continuation pc’ is triggered; or (ii) the dec 
field is false, that is the register has been decremented and the continuation pc is triggered. 

A refinement of the above register is used in Theorem [3.2] to demonstrate the Turing 
completeness of a sublanguage of Actor. 


Example 2.4. In Sections [4] and [5] we will respectively prove decidability results for two 
fragments of our actor language: in the first fragment only the main program can create 
new actors (so boundedly many actors can be created) and fields are read-only, while in 
the second fragment actors have an empty state. To illustrate these two fragments we show 
how they can be used to model a system in which n workers are used to execute n distinct 
tasks indicated by a client. 

In the fragment with bounded actors and read-only fields the model can be described 
by considering a class C for the client with an init method responsible for invoking the task 
manager, passing him the description of the n tasks to be executed: 


// C has no fields 
C.init( TManager) = TManager ! tasksEzec(ti,--- , tn) 


The task manager is an instance of a class providing a method called tasksExec able to 
pass to the workers the description of their relative tasks: 
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// TM has n fields called W1,--- ,Wn, 
T M.tasksExzec(pi,::- , pn) = W1! ezec(p1). --- . Wn! exec(pn) 


Finally, a worker is an instance of a class W with one method exec able to execute the 
passed task (we leave this method unspecified): 


// W has no fields and one method ezec(p) 

'The main program first instantiates the workers, then the task manager by storing in 
its state the reference to the workers, and finally the client; after the init method of the 
client is invoked passing him a reference to the task manager: 


let w; —newWin  ::: letw, =newWin 
let taskManager = new TMs(w;,:-: , Wn) in 
let client = new C in client! init(taskManager) 


In the fragment with stateless actors we present an alternative specification of the 
system in which the classes for the client and the workers are as above, while the task 
manager is defined as follows: 


// TM has no fields 
T M.tasksEzec(pi,:-- , Pn) = this! neztTask(pi,--- , Pn, £1, £2;,*** , En, £1) 
T M.neztTask(pi,--- , Pn, Vi, ,Un41) = [v1 = v2]0; let w = new W in w! ezxec(pi). 
this ! neztTask(po,--- , Pn, P1, U2,7 77 , Un+1, 1) 


Upon reception of the n tasks to be executed, the task manager passes the task descriptions 
to the method nextTask. This method instantiates one new worker, passes to it the corre- 
sponding task, and then recursively invokes itself to continue with worker instantiations. In 
order to execute exactly n recursive calls, n + 1 additional parameters are considered: in 
the first call all such parameters are distinct excluding the first and the last one, at every 
call the parameters are circularly shifted, and when the first two parameters coincide the 
chain of calls is terminated. 


2.2. 'The operational semantics. The operational semantics of the language Actor will 
use an infinite set of actor names, ranged over A, B, -... This set is partitioned by the 
actor classes in such a way that every partition retains infinitely many actor names. We 
write A € C to say that A belongs to the partition of C. In the following, the (run-time) 
expressions will also include actor names and, with an abuse of notation, this extended set 
of expressions will be ranged over by E. The set of terms that are variables or actor names, 
called values, will be addressed by U, V,---. Similarly for processes that, at run-time, may 
also have actor names. The extended set will be addressed by P. We notice that free(P), 
when P belongs to this extended set, may returns variables and actor names. We will also 
apply free(-) to tuples of (extended) expressions: free(E) returns the set of variables and 
actor names in E. 

The semantics is defined in terms of a transition relation 8 — S', where S, S', called 
configurations, are sets of terms A> (P, p,q) with A being an actor name, q, the state of 
A, being a map from fields(C) to values, where A € C, and q being a queue of terms m(U). 
The empty queue will be denoted with £. Configurations contain at most one Ar (P, p,q) 
for each actor name A. As usual, let —>* be the transitive closure of — and —>* be 
——*. 


ESU;8 £=fields(c) A= fresh(C) 
new C(E) Š A; Ap (0, [E =œ U],<),8 


Ej A U; :; S; for i€l.n 
Epse , Bn $ Ui, Un; Snc , Sn 


Table 1: The evaluation relation E -5 U S 


The operational semantics of Actor is defined in Table[2] where the evaluation function 
E - U ; S is used (defined in Table[I]. This function takes an expression E and a store 
y and returns a value U and a possibly empty configuration S of terms Ar (0,y,¢). These 
terms represent actors created during the evaluation — the names A are fresh — and q records 
the initial values of the fields of A. The auxiliary function fresh(-) used in the evaluation 
function takes a class actor and returns an actor name of that class that is fresh. In order 
to have a finitely branching transition system (see the remark at the end of this section), 
we assume actor names in classes are totally ordered and fresh(C) always returns the first 
unused name of the class C. In this way, fresh names are selected in a deterministic manner. 
The same auxiliary function is used in rule (INST) on a tuple of variables. In this case it 
returns a tuple of the same length of variables that are fresh. Also in this case, we assume 
a total order of variables and fresh(z), where z has length n, returns the least n unused 
variables. For notational convenience, we always omit the standard curly brackets in the 
set notation and we use “,” both to separate elements inside sequences and for set union 
(the actual meaning is made clear by the context). 

The initial configuration of a program with main process P is N > (P,2,€), where 
N is a name of the root, an actor of a class without fields and methods. We assume that 
the class of N does not belong to the classes of the program. Note that the root actor is 
guaranteed to terminate because its queue remains empty (no method invocation may be 
enqueued) and the main process (as any other one) terminates. 

We finally remark that transition systems of the language Actor are finitely branching 
(every state has a finite number of successor states) because the choices of fresh actor 
names (in the evaluation of new C) and of fresh variables (in the instantiation of the bodies 
of methods) are deterministic. 


2.3. Relevant sublanguages. We will consider the following fragments of Actor whose 
relevance has been already discussed in the Introduction: 


Actorpa is the sublanguage where the new expression only occurs in the main process (the 
number of actor names that it is possible to create is bounded). 

Actor'? is the sublanguage without the field update operation (f <4 E) (fields are read-only 
as they cannot be modified after the initialization). 

Actorps is the intersection of Actora and Actor*®. 

Actor“? is the sublanguage with classes without fields (objects are stateless). 
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(UPD) 
EU; S 
Ab ((t €x E).P,y,q) — A» (P, elt & U],q,8 


(LET) 
EU; S 
Ap (let z = E in P, p,q) — Av (PU/;],o,a).8 
(INVK-S) 
ESU: S 
Ap (A!m(E). P, o, q) — A? (P, 9,4 : m(U)),8 


(INVK) 


S 
Av (A'm(E). P, p,q), A' > (P' v! q) — Arp (P, p,q), A' > (P' g^ a! m(U),8 
(INST) _ 
AEC C.m(%)=P y=free(P)\«& y'= fresh(y) 
Av (0,o,m(U) -q) — Ar (PI4/ mis] /3]U /z], vo, a) 
(MATCH) 
E EU UU 28 
Ap ([E = E'P; Q, p,q) — Av(P,¢,q),8 
(MMATCH) 
E,E'SU,V;s UZV 
Ap ([E = F']P; Q, 9,4) —3À Ap» (Q,q,q),8 


(PLUS-L) 


Ap(P-Q,o,q) — Ar(P,o,q) 


(PLUS-R) 


Ap(P+Q,9,¢) — ArP(Q,9,9) 


(CONTEXT) 
S— y 


s,s” — S', s" 


Table 2: The transition relation S —> S’ 


3. UNDECIDABILITY RESULTS FOR Actora AND Actor”? 


In this section we establish the main undecidability results for the actor language in Section[2] 
In particular, we will prove the undecidability of termination and process reachability. 


Definition 3.1. Consider an actor program. The termination problem is to decide whether 
it has no infinite computation; the process reachability problem is to decide, given a process 
P, whether there exists a computation of the program traversing a configuration having a 
term Ap (P', o, q) with P’ being equal to P up-to renaming of variables and actor names. 


We will use a reduction technique from a Turing-complete model to our actor model. In 
particular, the Turing-complete models we consider are the 2 Counter Machines (2CMs) 
and a faulty variation of them. A 2CM is a machine with two registers Rı and R» holding 
arbitrary large natural numbers and a program P consisting of a finite sequence of numbered 
instructions of the following type: 

e j :Inc(R;): increments R; and goes to the instruction j + 1; 

e j : DecJump(R;,l): if the content of R; is not zero, then decreases it by 1 and goes to the 
instruction 7 + 1, otherwise jumps to the instruction l; 

e j: Halt: stops the computation and returns the value in the register R1. 

A state of the machine is given by a tuple (i, v, v2) where i indicates the next instruction 

to execute (the program counter) and v; and v» are the contents of the two registers. The 

user has to provide the initial state of the machine. The transition relation of the 2CM will 

be denoted by =>. 

The faulty variation of the 2CM we use are the “two Faulty Towers Machine” (2FTM, 
for short) [12]. These machines have two faulty registers Ry and Ro holding either arbitrary 
large natural numbers or the faulty value L. The program of a 2FTM is a finite sequence of 
numbered instructions that are the same of those in 2CMs. However, in contrast with 2CMs, 
2FTMs from a state (i, v1, v9) may nondeterministically evolve into a faulty state (i, L, v2) 
or (iv, L) or (à, L, L). If an instruction 4 is an Inc/DecJump that refers to the register 
R4 (respectively, R2) then (i, L,v) (respectively, (i, v, .L)) evolves to (0,.L, v) (respectively, 
(0, v, .L)). In 2FTMs, the instruction numbered 0 is always assumed to be Halt. Let —»r 
be the transition relation of the 2F'TMs. 

By definition, every 2CM program with a 0-numbered instruction Halt is a 2FTM 
program and conversely. If we restrict to 2CM with a 0-numbered instruction Halt, it is 
easy to verify that every such machine has an infinite computation with a 2CM-semantics if 
and only if it has an infinite computation with a 2F'TM-semantics. Similarly for instruction 
reachability, if we consider any non 0-numbered instruction. 

In the sequel, we consider 2F TMs and 2CMs whose initial state is (1,0, 0). 


3.1. The language Actorp4. We encode the value n stored in a register as n messages (of 
the same type) that are enqueued in an actor — see Figure[1] Namely, let Ry and Rə be two 
actors of class R and let the number of messages item in Rı and Rə be their value. 

The instruction Inc is implemented by inserting one item message in the queue of 
the corresponding register. In our formalism, this is done by invoking the method item 
whose execution has two possible outcomes: (i) the invocation is enqueued again; (ii) the 
invocation is discarded because we are in the presence of a residual of a DecJump operation, 
as described next. 
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R // R has fields dec, ctr, loop and stop 


R.item(tt, ff) = [stop = ff] ([dec = ff]this  item(tt, ff); (dec = ff)) 
R.inc(pc, t, ff) = [stop = ff|(loop 4 ff). this! item(tt, ff) . ctr ! run(pc, tt, ff) 
R. decjump(pc, pe’, tt, ff) = [stop = ff](loop = ff). (dec 4 tt) . this! checkzero(pc, pc’, tt, ff) 
)=[ 


stop = ffl(1oop — ff). 
([dec = tt]ctr ! run(pc', tt, ff). (dec 4 ff); ctr! run(pe, tt, ff)) 
R.init(tt, ff, Ctrl) = (dec 4 ff).(ctr 4 Ctrl).(1oop & ff).(stop & ff). 
this ! bottom(tt, ff) 
R.bottom(tt, ff) = [loop = ff|(loop + tt).this! bottom(tt, ff); (stop 4 tt) 


R. checkzero(pc, pe’, tt, ff 


Ctrl // Ctrl has fields stmj, ---, stm, and rı and r2 
Ctrl.run(pe, tt, ff) = [pc = stm][Instruction..1]:4,g 


[pe = stm] [Instruction_n]n tf 
Ctrl.init() = rı! init(t, ff, this). ra! init(tt, ff, this). this! run(stm, tt, ff) 
Ctrl.halt() = 0 


where [/nstruction.i]; 4g is equal to 

= tjl inc(stmi+1, t, ff) if Instruction_i = Inc(R;); 

— rj! decjump(stm+1, stmg, tt, ff) if Instruction. = DecJump(R;, k); 
— this! halt if Instruction i = Halt. 


The main process is 


let —newÜOtrl(i--.£newB(. 4 )n0ewB( .,.,_)) in z ! init(). 


Figure 1: Encoding a 2FTM in Actors, (“.” denotes an irrelevant initialization parameter) 


In case (i), to avoid an infinite sequence of item dequeues and enqueues, we introduce 
fields stop and 1oop which are initialized to false and set to true by the bottom method 
in case the queue contains only item messages. This has as effect that the stored item 
messages are subsequently purged from the queue of the register. Note that differently 
from the example in Section [2] we have encoded the boolean values as fields (so that we do 
not need to pass them around). 

In case (ii), registers have a field dec that is set to # by a decjump method execution. 
This field means that the actual decrement of the register is delayed to the next execution 
of checkzero. Since in (ii) item is not enqueued, then the register is actually decremented 
and the field dec is set to ff. When checkzero will be executed, since dec = ff then the 
next instruction of the 2CM is simulated. On the contrary, when checkzero is executed with 
dec = t then the decrement has not been performed (the register is 0) and the simulation 
jumps. 
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The Halt instruction is simulated by invoking a method halt that does nothing. 

As in the examples of Section [2] booleans are implemented by two variables — see the 
method Ctrl.init — that are distributed during the invocations. With a similar machinery, 
in the actor class Ctrl, the labels of the instructions are represented by the variables 
071,7: , Z4, Which are stored in the fields stm;,...,stm, of Ctrl. 


Theorem 3.2. Termination and process reachability are undecidable in Actorpa. 


The undecidability of termination in Actorpa follows by the property that a 2FTM 
diverges if and only if the corresponding actor program has an infinite computation. As 
regards process reachability, we need a smooth refinement of the encoding in Figure[I] where 
the Halt instruction is simulated by a specific process. 


Proof. Let us assume to have a fixed 2FTM and let [Instruction.i];,s,g be defined in Figure[I] 
Let also 


i de, 
[G, v1, v2) eg u- > (0,2, c), (vi # Land va # L) 
> ([Instruction. ilie f» Pctri: £); 
1D (0, Preg, bottom (t, ff) - item(tt, F)” ), 
D> (0 > Preg» bottom (tt, ff ) ` item(t, jf )) 
def 
[G,L.v)heg = N> (0,9,8), (v z L) 
PTR NCH ilie f» Pctri: £), 
B > (0 rene £), 
Rə > (0 > Preg» bottom (tt, ff ) ` item(t, ff )") 
def 
[(0, L, v) leg = Nb (0, 2, €), (v * L) 
C > (0; Petri; €), 
Re (0, Prag £), 
Ro D (0, Preg, bottom (tt, ff) - item(tt, ff )") 
where 


d E 
= ten Z [stm — 2,*<t-", r1 ++ Ry, r2 ++ Rol; 
d 
— reg Er [stop > ff, loop — ff, dec 5 ff, ctr + C]; 


d 
Boos E M e lf, 1oop t£, dec > ff, ctr > C]; 


— item(tt, fy = f item(tt, ff) --- item(t, ff). 
———————— 
v times 
the definitions of |(?, v, L)| s. y and |(0, v, L)] &. & and [(0, L, L)]4.¢ follow the same patterns). 
f NÀ Jf 
We first observe that N > (P, g,c) —>* [(1,0,0)]#,¢, where P is the main process in 
Figure [i] Then we demonstrate the following properties: 
(1) if (i, v1, V2) =F (j, v], v5) then [(i, vi, v2) ep —* [O. vi, 05) Dep 
(2) if [(ż, v1, v2)]4, has an infinite computation then the computation has infinitely many 
configurations like 


N > (0, Ø, £), C > ([Instruction-i]i e, gp, Pctr1,€), Fa > (Pi, v1, 1), R25 (P2,92,q2) (3.1) 
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(3) if 

N > (0, 2,£), C > ([Instruction i]; t, f, eti €), Ri > (Pi, v1, q1), R2 > (P2, 92, G2) 

——* 

N > (0, 2,7), C > ([Instruction_j] 50,6, Petri; €), Ri > (Pi, 91, 01), Ro > (P5, 95, 9) 
is a computation with every intermediate configuration having the process of the actor 
C equal to O then there are two computations 

N > (0, ©, £), Cr» ([Instruction.i]i,«,., (Pctrl; E), fü p (Pi, (91; q), Ro > (Po, p2, q2) 

—* [vivo 
and 

N > (0, Ø,€), C > (LInstruction_j] j,4,9, Petri; €), Fa P (Pi, v1, d), Ra > (Pz, 22,92) 

—* [G,vi, vou 
where the actor C never moves such that 


(i, V1, v2) >F (j, vis v5) à 
The proof of (1) is a straightforward case analysis on the type of instruction i. 

The proof of (2) uses an argument by contradiction. Assume that there are finitely 
many configurations like Then, there is an infinite suffix of this computation in which 
the actor C does not perform actions. This means that at least one actor R; performs 
infinitely many actions by executing the methods item and bottom. But this is not possible 
because bottom blocks the actor if it is invoked twice without executing update actions on 
the register in between. 

The proof of (3) simply considers two possible cases: either some fields stop is set to 
t during the computation or not. In the first case the corresponding register of the 2F'TM 
enters a faulty state L. In the second case the instruction has been correctly executed. 

The property (1) guarantees that if a 2FTM has an infinite computation then also the 
corresponding encoding has an infinite computation. The opposite follows from (1) and (2): 
if the encoding has an infinite computation, it traverses infinitely many configurations repre- 
senting configurations of the corresponding 2F'TM, thus it also has an infinite computation. 
'The undecidability result can be easily extended to the process reachability problem. It suf- 
fices to modify the process modeling an Halt (not numbered with 0) by replacing this ! halt() 
with a process Q different from all the other processes in Figure We have that Q is 
reachable if and only if the 2CM with the same program of the given 2FTM terminates. [ ] 


3.2. The language Actor'?. We show that Actor'? is Turing-complete by means of an 
encoding of a 2CM - see Figure[2] In this encoding the two registers are represented by two 
disjoint stacks of actors linked by the next field. The top elements of the two stacks are 
passed as parameters rı and r2 of the run method of the controller. As before, this actor 
encodes the control of the 2CM. 

The instruction Inc is implemented by pushing an element on top of the corresponding 
stack. This element is an actor of class R storing in its field the old pointer of the stack. The 
new pointer, i.e. the new actor name, is passed to the next invocation of the run method. 

The instruction DecJump is implemented by popping the corresponding stack. In 
particular, the method run of the controller is invoked with the field next of the register 
being decreased. This pop operation is performed provided the register that is argument 
of run is different from nil. Otherwise a jump is performed. Note that the other top of 
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the stack r; (i Æ j) and the next instruction to be executed are simply passed around and 
therefore they do not need to be stored in updatable fields. 


Theorem 3.3. Termination and process reachability are undecidable in Actor'?. 


Proof. It is easy to verify that if a 2CM has a computation 


(1,0,0) = (41, v1, v1) o E (in, Un, vh) 


then there is a computation 
NP (P,0,7 —* Np (0,0,¢), C > ([Instruction; ]naynit, 9, €) 
—* Xp (0,0, e), C > ([Instruction-ii]., 9,8), Ro, R01 
—* Np (0,0, £), C > ([Instruction is]. s v, 6), Rra ert Gn 
where P is the main process of Figure [2] [Instruction.i;],., r are defined in Figure B| y = 


[stm — z1,::: , stm, — r,,nil > nil], Rr, and R, are stacks of register actors whose 
length is v; and vj, respectively. For instance, A, of length k is 


rı > (0, [next > r2], €), ra > (0, [next > r3], &),--- , re > (0, [next > nil],&) . 


The configurations C; only contain register terms rp>(0, [next — 7r'], £) and represent garbage 
(they are inactive). 

In contrast with Theorem [8.2] the converse implication (every computation of the 
Actor'? program in Figure 2] may be split in subcomputations of finite lengths that corre- 
spond to 2CM transitions) is not difficult because the program of Figure B]is deterministic. 

'The above correspondence guarantees that the computation of the actor system termi- 
nates if and only if a Halt instruction is reached. The undecidability of process reachability 
is proved by using the same arguments of Theorem [3.2] O 


4. DECIDABILITY RESULTS FOR Actorýa 


We demonstrate that programs in Actort? are well-structured transition systems [1] [16]. 
'This will allow us to decide a number of properties, such as termination. We begin with 
some background on well-structured transition systems. 

A reflective and transitive relation is called quasi-ordering. A well-quasi-ordering is a 
quasi-ordering (X, €) such that, for every infinite sequence £1, £2, £3, :::, there exist i, j 
with i < j and a; < £j. 


Definition 4.1. A well-structured transition system is a finitely branching transition system 

(S, —5, <) where < is a quasi-ordering relation on states such that 

(1) < is a well-quasi-ordering 

(2) 4 is upward compatible with —>, i.e., for every 81 < S| and Sı —> S», there exists 
S, —* S5 such that S2 < S5. 


Given a state s of a well-structured transition system, Pred(s) denotes the set of immediate 
predecessors of s (i.e., Pred(s) = {s’ | s! — s}) while f s denotes the set of states greater 
than s (i.e., 1 s = (s' | s < s']). With abuse of notation we will denote with Pred(.) also 
its natural extension to sets of states. 

According to the theory of well-structured transition systems [16], we have that 
several properties are decidable for such transition systems (under some conditions discussed 
below). We will consider the following properties. 
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R // R has a field next 
R.dec; (ctrl, r, stm) = ctrl! run(next, r, stm) 


R.decg (ctrl, r, stm) = ctrl! run(r, next, stm) 


Ctrl // Ctrl has fields stm, ---, stm, and nil 


Ctrl.run(r1, r2, pc) = [pc = stm;]|Instruction. 1]... ; 


[pc = stm,][Instruction_n],, ro 


where |[Jnstruction_i],, ,., is equal to 
— this! run(new R(r1), ro, stm;,1) if Instruction_i = Inc(R4); 


— this! run(ri, new R(r2), stm;+1) if Instruction. = Inc( R2); 


- [ry = nil]this ! run(ri, ro, Stmy) ; r1! dec; (this, r2, Stm;,1) 
if Instruction_i = DecJump(Rj, k); 


— [ro = nil]|this ! run(ri, ro, Stm) ; r2! decg(this,r 1, stmj+1) 
if Instruction_i = DecJump(Ha, k); 


-0 if Instruction_i = Halt. 
The main process is let x = new Ctr1(x1,--- ,%p, nil) in x! run(nil, nil, x1). 


Figure 2: Encoding a 2CM in Actor*? 


Definition 4.2. Consider a well-structured transition system (S, —, <). Given S € S the 
termination problem is to decide whether S has an infinite computation; the control-state 
reachability problem is to decide, given T € S, whether there is T’ > T such that S —>* T. 


In well-structured transition systems termination is decidable when the transition re- 
lation —> and the ordering < are effectively computable. When it is also possible to 
effectively compute a finite-basis for the set of states Pred(T s) we have that control-state 
reachability is decidable as well. 

In the following we assume given an actor program with its main process and its set 
of actor class definitions. The first relation we convey is = that relates renamings, ranged 
over by p, p’, ... that are functions mapping variables that are not free in the main process 
into either actor names or variables. Let 


/ 


pop (f for every x,y: (i) p(x) = ply) if and only if. p'(x) = p'(y) 

" uM if p(x) or p'(x) is an actor name or 

p. pipe) a free variable of the main process 
Namely, two renamings are in the relation = if they identify the same variables, regardless 
the value they associate when such a value is a variable. For example, [r =œ y,y > z] + 
[r 9 z,y 9 z] and [r > y,y 9 yz 9 A= [x > ay = z',z A]. However 
[r > yy ZF [r 9 z,y — x] and [x ^ A] # [x — B]. In general, if p and p' are 
injective renamings that always return variables then p 2 p'. The requirements of ~ are 


stronger for actor names: in this case the two renamings should be identical. By definition, 
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renamings in relation according to = never apply to free variables of the main process. This 
because these variables are possibly stored in fields of actors and their renaming might 
change the behaviours of actors in a way that breaks the upward compatibility of the 
following relation < and —> (c.f. proof of Theorem [4.4] part (2)). From this also follows 
that the above renamings do not change the main process (because they do not apply to its 
free variables). 

Let dom(p) be the domain of the renaming p. We denote by Pp the result of P[((?)/;], 


where Z = z1,::: , 2p is a tuple containing the variables in dom(p) (without repetitions) 
and p(X) = p(z1),::* , p(zn). 
Next, let ^ be the least relation on terms m(Uj,--- , Un) and on processes such that 
pp pp 
m(p(z1), UU ; pv.) > m(p' (21), UU , p' (x) Pp > Pp 


For example, it is easy to verify that m(z, y) ~ m(x', y') and that [r = Aly! m(z, A,y) ~ 
[z = A]y' ! m(z, A, y). On the contrary [x = AJB ! m(x, A, B) z [z = Aly’! m(z, A, y). The 
rationale behind ~ is that it identifies processes that “behave in similar ways”, namely they 
enqueue “similar invocations” in the same actor queue. Method invocations m(U1,--- ,Un) 
of a given actor are identified if the processes they trigger “behave in similar ways”. 


Lemma 4.3. Let T be either a method invocation m(U;,--- ,Un) or a process of a program 
in Actorpa (and therefore in Actori). Let T = (Tpi,Tpo,Tpa,:-:) be such that i A j 
implies Tpi £ Tp;. Then T is finite. 


Proof. We demonstrate the lemma for processes, the argument is similar for method invoca- 
tions. So, let P be a process. It is possible to count the number of renamings p on free( P) 
that are different according to =. In fact, the values of renamings on variables that are 
different from free(P) do not play any role in the definition of 7. 

The basic remark is that a renaming p generates a partition of the set free(P): two 
variables r and y are in the same partition if and only if p(x) — p(y). If we restrict to 
renamings that map variables to variables (and not actor names), then they are different 
according to = if they yield different partitions. The number of such renaming is the Bell 
number of the cardinality of free(P), let it be Be11(&), where & is the cardinality of free( P). 
In addition, in our case, renamings may map a variable to an actor name into a finite 
set {A,,--- , Ag). In this case the identity of the actor name is relevant. If & > £ then 


(( : ) x #141) x Bell(&) is an upper bound to the different renamings according S. If 


k < L then the upper bound is (4!/k! + 1) x Bell(&). In any case the number of different 
renamings according to ~ is finite. 
Henceforth the set 7 is finite as well. O 


The well-quasi-ordering relation on configurations relies on an (almost standard) em- 
bedding relation < on queues (except the part about œ, it is the one in je 


there exist 11 < i2 < «-- < iy € h such that, for j € 1..k, mj(U;) = ni, (V;,) 


ma (Ui)... mp (Ur) € m (Vi)... ni (Và) 
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Then, let 
P,~P! and qi <q, foric 1.4 


U 


Ai P (Pi, 91,01), , Ace (Pe, ge qt) < Aio (Poi di) Aer (Pe, Ye, qe) 
It is worth noticing that the relation < constraints corresponding elements Ar (P, y,q) and 
Ap (P', io, q') to have the same states. In fact these states are defined by the main process 
using either its free variables or the actor names that it has created. For this reason there 
are finitely many of them and the relation < is parametric with respect to them. 


Theorem 4.4. Let (S,—+) be a transition system of a program of Actorge. Then (S, — 
, X) is a well-structured transition system. 


Proof. (1) < is a well-quasi-ordering. To prove that < is a well-quasi-ordering, we reason 


by contradiction. Let 81,82,83,::: be an infinite sequence of states in S such that, for 
every i < j, S; £ Sj. Let y1,---,Y%m be a sequence of variables not free in the main process. 
Consider: 


subterms(C) - (P | there exists a method m s.t. P is a subterm of C.m(z)) U 
im(yi,:::,yg) | there exists a method m s.t. C.m(z) with |z| = g} 

The set subterms(C) is finite, but all the —possibly infinitely many- processes that can be 
executed (or the messages that can be received) by an actor of class C are renamings Pp 
(or m(y)p) of these terms. Notice that by Lemma [4.3] the number of terms Pp (and m(y)p) 
which are different according to ~ is finite as well. It is thus possible to extract a subsequence 
Siis Siz, Siz, te from $1,S2,S3,--- such that, for every A, in the elements Ar (Pf Pi, ej qi.) 
and Ap (PA Biss på : q4) of Sj, and S;,, respectively, we have that PA pi ~ Pe pip Moreover, 
as we are considering Actorýg the actor state cannot be modified, hence ej = på : 


As we are considering Actorýs, the set of actor is bound. Let Aj,--- , A; be such actor 
names. Due to the above arguments, the sequence 8;,,8;,,8;,,::- may be represented as a 
sequence of tuples of queues: 

A A A A A A 
gue uq (ee ot s e rues 
: se (Ay Ary p (Al Ag m : 
such that S;; < S;, if and only if (aj; D jui (;, pera ), where E* is the coordi- 
natewise order defined by 
—£ def 
(a. aqe) E (di 9) = for everyh : dn € dn 


(€ is the above embedding relation). 

We are finally reduced to an infinite sequence of tuples of queues such that every tuple 
cannot be in relation according to ^ with any of the subsequent ones. This fact contradicts 
the 

Higman's Lemma [21]: if (X, X) is a well-quasi-ordering and (X*,<*) is the set of finite 
X -sequences ordered by the embedding relation <* defined using < as pointwise ordering, 
then (X*, €*) is a well-quasi-ordering. 


More precisely, the contradictions follows from the following consequence of the Higman's 

Lemma: 

e if X is a finite set and (X*, <) is the set of finite X-sequences ordered by the embedding 
relation, then (X*, X) is a well-quasi-ordering. 

and from the following statement 
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e if (X, X) is a well-quasi-ordering then (X*, <^) is a well-quasi-ordering. 


(2) < is upward compatible with —>. A state q is normed, if, for every field f, v(£) 
is either a free variable in the main process or an actor name. A configuration is normed 
if the states of the actors are normed. _ We observe that the initial configuration is normed. 
We also let (E)p c (E)p! whenever e - p. 

We first demonstrate that, if E & U ; S with y normed, then 


(exp-i) if E ~ E! and S = Ø then E! SU’; Ø and Ù œ U’; 

(exp-ii) if E (respectively P) only contain free variables in the main process and actor 
names ius E c E! (respectively P ~ P) implies E = E' (respectively P =a P^") 
and ESU: ; S implies that U contain free variables in the main process and 
actor names and S is normed. 

(exp-i) is proved by induction on the hight of the proof-tree of EAU ; @. There are 
two basic cases: (1) E = U and (2) E = f. As regards (1), E' = U’ and the property 
is immediate by the hypothesis that E ~ E'. As regards (2), E' = f because E ~ E"; 
henceforth the property (because E' is evaluated in the state y as well) There is one 
inductive case (because the case of new is not possible, otherwise S cannot be empty), 
which is immediate. 

(exp-ii) is an immediate consequence of the definition of 5 and A. 


Let S; —> S2. We demonstrate that 


(i) if S1 is normed then S2 is normed as well (this means that the transition system 
(S, —+) of a program of Actor{? has normed configurations because the initial state 
is normed); 

(ii) if S1 < S, then there exists S? —>* S5 such that S2 < S5. 

As regards (i), it follows by remarking that in programs of Actorf@, there is no field update 
and the unique process that may create states is the one of N (the main process). Then (i) 
derives from the property (exp-ii). 

As regards (ii), its proof is a case analysis on the proof-tree of Sı —> S5 where 
the cases correspond to the unique rule appearing in the tree that is not an instance 
of (CONTEXT). Let Sı = Ai > (Pipy, 91,01), , Ae P (Pepe, qo, qe). Since Sı < Si then 
S1 = Aie (Pip qi. di) » Aed (Pepp, Pe, qg) such that, for every i, Pip; = Pipi and qi < qj. 
'The cases are discussed in order. 

(1) Sı — S» contains an instance of (LET), namely 


Ap (let z = E inP,y,q), — Abp (P[U/z], 2,4), S3 


where E & U; S. By Sı < S4, S, must contain Ap (let x = E' in P', Ø,£) such that 
let x = E in P ~ let x = E' in P' (without loss of generality, we are assuming the 
two bound variables are the same) and q < q'. There are two subcases: (1.1) A = N and 
(1.2) A Z R. In (1.1), By (ezp-ii), this is possible provided E = E' and P =, P’. It is 
easy to verify that S? —> S5 and S2 < S5 because their unique difference with Sı and 

S! is due to the two processes P and P’. In (1.2), 83 = Ø because no new can occur in 
E. Additionally, by definition of ~, E ~ E' and P ~ P’. Let E' -5 U', Ø. By (exp-i) 
we have U ~ U' and it is easy to verify that P[U/,] ~ P'[U'/,]. Henceforth S, — S 
and Sy < S5 because their unique difference with S, and S4 is due to the two processes 
P[U/,] and P'[U'/,]. 
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(2) 


(6) 
(7) 


Sı — S2 contains an instance of (INVK-S), namely 
Av (Alm(E).P,y,q), — A> (P,y,q-m(0)) . 
Since Sı < Sj then S| contains A > (A!m(E'). P',q,q') with E ~ E’, P ~ P', and 


q < q. We observe that A # N and if BS U, @ and E’ & U', Ø then U ~ U' 
by (exp-i). Therefore q- m(U) < q': m(U') and S} — S, with S2 = S, because 
their unique difference with Sı and S is due to the two terms Ap (P,y,q-m(U)) and 
Ab CP sd; q' ` m(U')). 

Sı — S2 contains an instance of (INVK), namely 


Ap (B!m(E).P,o,q), B> (Q, Y, p) — Ab (P, 9,4), B> (Q, v; p. m(U)), 8s. 


There are two subcases: either A = N or A z N. When A = N the proof is similar to 
the above case (1.1); when A Æ N the proof is similar to case (2). 
Sı — S2 contains an instance of (INST), namely 


A» (0, p, m(U) -q) — Ad (PH nis] /g]U /3], 9.9) | 
where C.m() = P, C being the class of A, y = free(P) Vx and y! = fresh(y). Therefore 
Sı = Ap (0,m(U) ` q), Ti and Sg = Ap (PIA/ this] [/g][" [3], a). T1. Since 81 < S! 
then 81 = A> (0, p, ni(Vi) ^ n&(Va&) : m(V) - q'), Tj and m(U) ~ m(V) and q < q' and 
Tı < Ti. By the operational semantics rules, we get S} —>* Ap(0,y,m(V)-q'-q"), TY by 
performing transitions of the actor A, with T, < T7 and, by definition, q< q':q". At this 
stage, we notice that Ap (0, o, m(V):q' aq"), Tj — Ap(PI4/ mis]E/sllV /al, 9, a q”), TY. 
We notice that P[4/au]IV /5][7/3] = PIA/na]lj > y, > Ù] and PIA/ nisl P/a]? fal = 
PA hill — Z, Z — V] and [y > y’, Z U] È [y > Z, $ — V]. Therefore 
PIA/ ais] f/gllV /z] = PIA trisl E/V /sl 
which implies that S, —>*—> S5 and S2 < S5 because their unique difference with S; 


and $1 is due to the two above processes. 
Sı — S2 contains an instance of (MATCH), namely 


Ap ([E = E']P;Q,o,q) — Av(P,9,q),83 . 


We discuss the case A Z N because the other one is similar to (1.1). There are three 
subcases (5.1) both E and E' are variables; (5.2) E is a variable and F” is a field; (5.3) 
E and E' are both fields. In case (5.1), let E = x = E'. Since 81 < S$}, then S, must 
contain A» (|z = z|P'; Q', p,q) with [r = z] P; Q ~ [z = z|P'; Q' and q < q'. Therefore 
we may use (MATCH) to derive S} —> S with Sg < Sj. In case (5.2), let E = U 
and E' = f. There are two subcases: (5.2.1) U is a variable or (5.2.2) U is an actor 
name. In (5.2.1), U has to be a free variable in the main process because we are using 
(MATCH) (f may contain either such variables or actor names, additionally, renamings 
never return free variables in the main process). Therefore, by Sı < S}, we have that S! 
contains Ap ([U = £|P'; Q', o, q') with [U = £]P; Q ~ [U = £|P'; Q' and q < q'. The 
consequence is that S! —> S5 with S2 < S5 because their unique difference with Sı and 
S! is due to the two either the pair of processes P, P' or Q, Q'. Similarly for (5.2.2). 
The case (5.3) is obvious. 

Sı —29 S2 contains an instance of (MMATCH). Similar to (5). 

Sı —> S2 contains an instance of (PLUS-L) or of (PLUS-R). Straightforward. O 
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We notice that the well-structured transition system (S,—+,~<) has decidable algo- 
rithms for computing < and for computing the next states. Then decidability of termination 
directly follows from the above mentioned results of the theory of well-structured transition 
systems that we have previously recalled. 


Theorem 4.5. In programs of Actors the termination problem is decidable. 


We now move to the definition of an appropriate algorithm for the computation of a 
finite basis for the predecessors of a given configuration, so to conclude also the decidability 
of control-state reachability. 


Lemma 4.6. Let (S, —, <) be a well-structured transition system of a program in Actor¢e, 
and let S € S. Then there is a finite set X C Pred(S) such that, for every S' € Pred(S), 
there is T € X with T 4 S'. X can be effectively computed. 


Proof. We show how to compute X. Let S = Ap (P,q,q), S'. The predecessor processes of 
P are the following ones: (i) let x = E in P', with P = P'[U/;], for some U and some Z; 
(ii) z!m(Ei,--- , En). P; (iii) [U = U] P;Qs; (iv) [U = V] Q; P; (v) P+Q; (vi) Q +P; 
(vii) P is an instance of a method body of the actor class of A. If A is of actor class C then 
we take all the method bodies of C with a suffix matching one of the cases (i)-(vi) above 
(in this case, the expressions in (7) are either variables or actor names). If A = N then we 
look for a matching suffix of the main process. The above six cases are demonstrated in the 
presence of such suffixes. 

We only discuss case (7), the other ones are similar. In case (i), if A is of actor class 
C, then E = y, for some y. If x € free(P’) then X contains the configuration Ap (let x = 
y in P',o,q),S' with P = P'[v/,]. Otherwise ¥ contains the configuration Ar (let z = 
z in P',q,q), S', for z € free(P') and for a unique z ¢ free(P’). When A = N then E may 
be new C (orherwise the argument is as before). If x € free(P’) and S' = A’p (0, , £), S" 
with A’ € C then X contains the configuration A> (let x = new C in P',q), S" (and this 
for every possible A’ € C such that A' » (0,£) is in S’). O 


Lemma[A.6]and the above mentioned results on well-structured transition systems allow 
us to decide the control-state reachability problem. 


Theorem 4.7. In programs of Actors the control-state reachability problem is decidable. 


Proof. Let f S = {9 € S |S < S'). Let also Pred(t S) = (T | T —> S' and S' > Sj. By 
definition of <, Pred(t S) C Pred(S). Therefore + Pred(T S) C t Pred(S) C t X, where X is 
the finite set of Lemma [4.6] that is effectively computable. O 


Next we discuss the process reachability problem — see Definition — in Actor. To 
this aim, we use a simpler version of the (classical) diamond property. 


Proposition 4.8. Let (S,—+) be a transition system of a program of Actorýg and let 
N > (P,8,7,8 — N > (P,@,¢),S’ N does not move) and N > (P, £), — N > 
(P', 8,7), S" with P' Z P (N moves). Then there exists S" such that X > (P, Ø,£),S — 
Nb (P', g,e),S" — N >è (P' o, e), s". 


It is worth noticing that the language Actor also owns the more classical diamond 
property: if in a configuration there are two transitions inferred by two distinct actors, then 
it is possible to perform them in any order reaching the same configurations up-to bijective 
renaming. We omit the formalization of this property since it is not needed in the rest of 
the paper. 
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Corollary 4.9. The process reachability problem is decidable in Actors. 


Proof. In order to verify whether a configuration Ar (P, v, q), S is reachable with P’ equal 
to P up-to renaming of variables and actor names, we proceed as follows. 

First, by Proposition it is not restrictive to consider the set of configurations T 
reachable by completely executing the actor M only. The cardinality of 7 is bounded by 
2^. where k is the maximal nesting of + in the main process. If one of the processes in 
the configurations reached by executing N is equal to P, up-to renaming of variables and 
actor names, then we are done. Otherwise, let ù be the free variables in the main process. 
For each of T = Np (0, S, £), Ay P (0,901,091), , Ag > (0,95, qe) in T, we check control-state 
reachability from T to at least one of the states in the following finite set: 


{ ND (0, 2, E), Aib (Qi [^:/ iis] [a/g], P1, E), roe AyD (Qel / tis] [*/ 5; [U*/ s ], Pe, £) 
| for every 1l € à € £, Qi is a suffix of the body of m; in Cj, where A; € Ci, 
formal parameters and free variables of m; are x; and Y; 
U; is a tuple in (Ai,..., An U, Z} (Z, Zi, , Z% are fresh) 
there exists 1 < j < £ such that Q; is equal to P up-to renaming | 


Then the corollary follows by Theorem [4.7] L1 


We conclude this section by recalling that we have already proved the undecidability 
of termination in programs with unboundedly many actors and read-only fields. Note that 
if we remove from Actor; the constraint on bounded actor names then the relation < is 
no longer a well-quasi-ordering. Consider, for instance, an actor (with empty state) having 
a method that first creates a new instance of the same class and then invokes on this new 
instance the same method. Among the reachable configurations it is possible to select a 
sequence 81,85,83,--- such that the configuration Sp is defined as follows: 

Sn E A110, 0,6) ,*** , An D (0,0, €) 


It is easy to see that, for every i < j, 8; £ Sj. 


5. DECIDABILITY RESULTS FOR Actor?! 


We prove that in Actor?! termination and process reachability are decidable, too. As 
discussed at the end of Section [4| the ordering defined for Actorý$ is not appropriate for 
Actor?! because in the latter it is possible to dynamically produce unboundedly many actors. 
Therefore, in order to compute an upper bound to the instances of method bodies, which is 
the basic argument for the model of Section [4]to be a well-structured transition system, we 
need to abstract from the identity of these names — as we have done with variables. However, 
in case of actor names, the abstractions we have devised all break the delivering of messages. 
Therefore we decided to apply our arguments to an abstraction of the operational model 
where the delivery of messages is inexact: it may be enqueued in every actor of the same 
class. Yet, this abstract model allows us to derive decidability of termination and process 
reachability for the original language. 

In order to formalize the correspondence between the concrete and the abstract oper- 
ational semantics, we need to add decorations to processes and transitions at the concrete 
level. Such decorations are used to keep track of the causal dependencies among processes. 
'The decorated syntax adds a sequence of natural numbers in front of the process of an actor, 
namely, we use AP (c : P,@,q) where c has the following meaning: if o = o' - n, then o’ 
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The decorated evaluation relation E ^U ; S: 


EwU:S A — fresh(C) 


U -^Q4U;6 — € (i NM 
new C(E) ~q A; Ar (£:0,0,7),8 


Ei ~a Ui; Si, for i€l1l.n 
Ei, QES ~a Uite Uns Dj" , Sn 


The decorated transition relation 8 = Y: 


(LET4) 
E-4U;S 
Ap(c:n:letz—EinP,9,q) pans. Ap(o-n+1: P[U/,],2,q),8 
(INVK-Sq) 
EwqgU0;8 
Ap(o-n: A!m(E).P,2,q) 


as DA [7 
VIMUS  Ab(o.n-1:P,2,q-m(U,o n4 1),8 


(INVKa) 
E QU ; S 
Ar (c «n: A!m(E). P, Øq), A' > (o! : P',g, q') 


o- U,A' m 
as Ar (c-n--1:P,0,9), A > (c' : Pg, q' - m(U,o -n+ 1),8 


(INST q) 


AEC C.m(%) =P j-fre(P)N€ y'= fresh(7Z) 


Ap (o :0,8, m(U,c)-q) 4 Ap (0-0: PIA misl” /g](U /3]. 2.9) 
(MATCHg) 


E, F' ~4U,U ; S 
A> (o-n: |E = E']P; Q, O,q) ean A> (o-n+1:P,Ø,q),S 


(MMATCH4) 
E, E' ~4U,V;S UAV 
Ap(o-n:|[E = E'|P; Q, O,q) TR Ap(a-n+1:Q,2,q),$ 
(PLUS-L4) 
Ap(o-n:P4+Q,2,¢q) pillars Ap(a-n+1:P,9,¢q) 
: (CONTEXT) 
(PLUS-Rq) -— s ES g 


Ap(o-n:P+Q,2,q) —> Apb(o-n-c1:Q,2,q) = 


s,s” — S', S" 


Table 3: The decorated operational semantics of the language Actor?! 


identifies the action of emission of the message that caused the method instantiation from 
which P was generated, and m is a counter indicating that P is actually generated by the 
method instantiation after n steps. Notice that for the main process executed by the actor N 
the sequence o’ is empty, and that when a method is instantiated the counter n is initialized 
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(INVK-Sa) 
E ~4U;S AA EC 


ze o-n--1|m(U ,A' 
| C ) Ap( 


A> (o-n: A'!m(E). P, 9,q) o-n+1:P,2,q-m(U,o-n+1,A’)),8 


(INVKa) 
E-Q.U;S AA” eC 
Ap(o-n: A'Im(E). P, Øq), A" > (o! : P’,2,q’) 
POT] Ar(c-n-c1:P,09,q), A" > (c' : P',g,q -m(U,o n4 1, A’)),S 
(INSTa) 


AEC C.m(%)=P j-fre(P)N€ y — fresh(i) 
Av (0, 2, m(U,c, A) d) 5, Ar (o0: PIA / is] /3)U /s]. 2,9) 


Table 4: Abstract transition rules for method invocations and instantiations 


to 0. In order to transfer the sequence from the message emitter to the receiving actor, we 
add o at the end of messages. Namely, messages are now denoted with m(U,c). The deco- 
rated operational semantics s—> S' is defined in Table B| where the label o can be either 
a sequence g or a pair o|m(U,A) where the second element identifies the message issued 
during the transition. The decorated operational semantics increments the last number of 
the sequence of a process every time it performs an action, adds to messages the current 
sequence of the emitter, and use the sequences inside messages to initialize the sequence of 
the method instantiations (by extending it with 0). 

It is trivial to see that the operational semantics in TableBland the decorated semantics 
coincide, in the sense that given one configuration Sı of Actor?! we have Sı — S2 if and 
only if there exist a label a and two decorations S, and S5 of Sı and S2, respectively, such 
that S > sb. 

As discussed at the beginning of this Section, we need a more abstract semantics with 
inexact message deliveries. This is obtained by changing the operational semantics in Table[3] 
by decoupling the evaluation of the body of a method from the actor name of that method. 
Let S —5», S' be the abstract transition relation defined as S > S' in Table B] except 
the two rules (INVK-Sq) and (INVK4) for method invocation and the rule (INST4) for the 
instantiation of method bodies, which are replaced by those in Table[4] In the abstract 
transition relation, a message is added in a queue of an actor nondeterministically selected 
among those belonging to the same class of the target actor. The item m(U,c) is enqueued 
with an additional argument — the actor name of the target actor. This additional argument 
is used when the method body is instantiated. In fact it replaces the variable this, thus 
making the execution of a body invariant regardless the actor that actually performs it. 

As an example, consider the task manager specified in Actor?! in the Example 
Also under the abstract semantics n distinct workers are instantiated, but it is possible for 
two distinct tasks to be delivered to the same worker. 

We now introduce few notations: 

— Let Q() be a map from “concrete” to “abstract” configurations: given a configuration S, 
we denote with (S) the configuration obtained from S by replacing each of its actors 
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A> (o : P,0,q) with A» (c : P, 2,q') where q’ is obtained from q by adding to each 
method invocation the parameter A. 7 

— Given a decorated configuration S and a label a, such that a = e or a = o|m(U, A), 
we use S|, to denote the process decorated with o in S: S|, = P if S contains the actor 
Ar (c : P, Øq), for some A and q. 

— Let 5 be the following relation on variable renamings (not applied to variables that are 
free in the main process) 


p=ap = for every c, y : 
(i) p(z)=p(y) ifandonlyif p(x) = p(y) 
(ii) p(w) EC ifandonlyif p(x) Ec 


" if p(x) or p'(x) is a free variable 

(iii) p(x) = p'(z) s mia i uM 
Differently from the definition of =, =, does not care of the identity of actor names (it is 
sufficient that they belong to the same class). 

— Let ~, be the relation defined as ~ in Section Æ| with =, instead of =. We extend it to 
messages containing sequences and actor names as follows: m(U, oc, A) œa m(U '0', A’) 
iff m(U) 2 m(Ū'), c =o’ and there exists C such that A, A’ € C. We extend it also to 
labels: o ~, o and o|m(U, A) ~, c |m(U', A’) iff m(U) ~a m(U’) and there exists C such 
that A, A' € C. 

The following Proposition formalizes the correspondence between —» and —5a: 1. all > 

transitions are present also in —5, (up-to application of the abstraction function (() to con- 

figurations) and 2. all the abstract computations So —M ... “3, Sn have a corresponding 
concrete computation Sh i! E S/, in which they can be embedded. 

Proposition 5.1. Let S and So be a decorated configuration and an initial decorated con- 

figuration X > (0: P, 9,&) of Actor?l, respectively. 


(1) If S 5 S then Q(S) —S, A(S'); 


(2) if So a ... “3, Sn then there exists a computation Sh x si... “3 S/. and an 
injection I such that, for all 1 <i € n, we have a; ~a Qr) and Sila; =a S) lof 


Proof. The first item trivially holds because the new rules used in the definition of —5, are 
(strictly) more general than the corresponding rules used in the definition of 5, 

The second item is proved by induction on the length of the computation So —5, 
TN ON Sh. 

If n = 1 then Sy —4, 8, with ay = 1 or a, = 1|m(U, A) and Sıla = P’, where P’ is an 
immediate derivative of the main process P. It is trivial to see that the same transition is 


present in the concrete decorated semantics: namely, N > (0: P, 2,&) it S! with o ~a o4 
and Sila, c, P’. 


If n > 1 we consider So E E m Sn41- The inductive hypothesis guar- 
antees the existence of the concrete computation Sj ee sl, and of the injection I 
such that, for all 1 <i € n, we have a; ~a ara and Sila; ~a S^) lot We now proceed 


by case analysis on the last number of the sequence in o1. 
If the number is 0, then o4,4,1 = c - 0 and the transition is obtained by applying rule 
(INSTg) on a message m(U,o, A’). The presence of this message in one of the queues in 
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Sn guarantees the existence of 1 < j < n such that aj = c|m(U, A’). In the concrete 
computation we have Qr) £9. c|m(U , A’). This means that the same message (up-to ~a) 
is in the queue of an actor A" such that A', A" € C in the concrete state S5 We have 
two subcases: either such method invocation is instantiated by the actor A" during the 


concrete computation Sp S" em ~ S^, or not. In the first case, there exists I(j) <l € m 
such that a; = 0-0 that nbus the method. The thesis is proved simply by extending 
the injection J with I(n + 1) = | and observing that S541[o.9 ~a Sj[o-o. If the method 
invocation was not instantiated, it is in the queue of the actor A” in the configuration S/,. 
It is sufficient to apply the same reasoning on an extension of the concrete computation 
that consumes the messages in front of the method invocation with sequence o and that 
finally instantiates it. Such extension exists because processes are finite and non-blocking. 

If the number is not 0, we discuss only the case in which o441 = co: k (with k > 0) 
because the case a = c k|m(U, A) is treated similarly. In the computation So —5, ... 25, 
Sn is guaranteed the presence of a label containing ø- k — 1, i.e. there exists 1 < j < n such 
that the label a; contains ø - k — 1. The process S;|5; is the process that has just performed 


the action labeled with o - k — 1 and that performs the action in the transition Sn E Sndi 
because a,+1 = c: k. By inductive hypothesis Sj|a; ~a Silat, i hence a process ready to 
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execute an action labeled with the sequence c - k occurs also in the concrete state S y We 

now consider two subcases. 

e There exists no label o/ containing c -k. In this case the process SG) loti j still occurs in 
J 


Y" ; ; 1 m ; k 
a: Hence it is possible to extend the computation Sh ce cg ups ZS S ut 


in such a way that S7, 41lo-k ~a Sn+1lo-x. The thesis is proved simply by extending the 
injection 7 with (n 4- 1) 2 m +1. 

e There exists I(j) < 1 € m such that oj contains ø -k. In this case it is not guaran- 
teed that S' tol C3 Sn+1lo-k, due to nondeterminism. For this reason we construct from 


Sh s. y si, another concrete cori putation that satisfies our thesis. The first trans- 
formation that we apply to Sy REN - om, S! consists of the cancellation of the transition 
a, and of all the other transitions that depends on it. Namely, there are two kinds of 
transitions that must be removed: (i) those labeled with a sequence having a prefix o - r 
such that r > k and (ii) those causally dependent on the instantiation of messages that 
are in Sj incide the queue of the oor containing the process decorated with c - k. Let 


So E = Br at, S ees Sm S7 be the concrete computation obtained after this 
cee of transitions. We now extend such computation by letting the process labeled 
with ø- k — 1 to execute the expected action labeled with o- k. Namely, we add the tran- 
sition S/ 24 i —3 S% 1 such that S7 ilok ^a Sntile-n- Then, we extend the computation by 
performing at least all the transitions removed for the reason (ii) above. This extension ex- 
ists because all processes are finite and nonblocking and because the considered transitions 


causally depend on messages that are in t 1 ingide the queue of the actor containing the 


process decorated with c. k. Let Sf oc Bid zh S, ewe Ts, g” Ecc NM S} be 
the obtained computation. The thesis is proved by considering this last concrete compu- 
tation, a rearrangement of the injection J that maps to their new positions the transitions 
in its codomain that belong to the group (ii), and by extending it with J(n 4-1) — 1. O 
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As a direct consequence we have that the abstract semantics preserves both termination 
and control-state reachability. It remains to prove that termination and process reachability 
is decidable for the abstract semantics. To this aim, we consider a transition system —>, 
obtained by removing the labels from the transitions —»4. On this transition system we 
define <a as a variant of the ordering < defined in the previous section in such a way 
that (S, —94, Xa) turns out to be a well-structured transition system (for configurations of 
stateless programs). Let: 

— Let <, be the following relation on message queues: 

there exist i1 < 19 < --- « diy <h s.t. for j € 1..k, m;(U;,c;, Aj) Sa Tii; (V; d! Az) 


m4 (U1,01, A1)...me(Uk, ox, Ak) Sa mi(Vi o1, Ah)... na (Vn, 01, AL) 


— Let <a be the ordering: 
Ai, A5. EC; P œ P: and qi <a dj. fori € 1.4, 1< j <j < «jk 

A, > (oy : Pi, Ø, q), ZEUG : Pi, D, qe) Xa A! > (e + Pi, S qi) , A, P (of, : P! S, q4) 

Next, we observe that Lemma can be adapted to the case of unbounded actors 
by using ~, instead of ~. Namely, let T be either a process or a method invocation 
m(U1,--- ,Un,o, A) of a stateless program and let 7 = {T p1, T po, T p3,:-- } be such that 
i Æ j implies Tpi a Tp;. Proceeding as in the proof of Lemma [4.3] we prove that 7 is 
finite. 


Theorem 5.2. Given a stateless program S we have that (S, —954, Xa) is a well-structured 
transition system. 


Proof. The proof is as in Theorem [4.4] with few differences that are discussed below. 

In part (1) the unique difference is in the last part where the coordinatewise order E^ 
on sequences (of length /) of queues of terms is used. As we now consider configurations 
with an unbounded number of actors, instead of configurations with a bounded number £ 
of actors, we need to resort to the embedding CE, defined as follows: 


qi SKa q, dorield£ 1 < ji < js < jee 
Ji 


(d31,:::,q0) Ea (d 7:04) 

The final contradiction of part (1) is now reached by observing that by Highman's lemma, 
also C, is a well-quasi-ordering, as a consequence of the well-quasi-ordering <a. 

In part (2) the unique difference is for the monotonicity transitions due to rules (INVK- 
A) and (INVK-SA). The greater configuration is guaranteed to have a program ready to 
perform a corresponding method invocation, but this could be addressed to a different 
actor. In fact, the ordering <a does not preserve actor names as it was for < in the proof 
of Theorem [4.4] But Xa preserves at least actor classes. As the abstract transition system 
—24 allows a term m(U,c, A) to be introduced in the queue of any of the actor belonging 
to the same class of A, the method invocation executed by the greater configuration can be 
introduced in the queue of the actor corresponding to the target of the method invocation 
executed by the smaller configuration. L1 
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In the light of the results on well-structured transition systems recalled at the beginning 
of Section [4] this theorem proves the decidability of termination for the abstract semantics. 
'To prove the decidability of process reachability we need to prove that a finite basis for 
predecessors is effectively computable. 


Lemma 5.3. Let (S,—>a, <a) be a well-structured transition system of a program in 
Actor?l, and let S € S. Then there is a finite set X such that, for every S! =, S and 
S" € Pred(S'), there is T € X with T <, S". X can be effectively computed. 


Proof. The computation of X must extend the construction presented in the proof of 
Lemma [4.6]in two ways. 

The first extension derives from the fact that, differently from the ordering < considered 
in Lemma [4.6] if S <, S’ it could be possible for S’ to have strictly more actors than S. In 
these case, it is possible that the predecessor differs from its successor S' for actors that are 
not present in S. We can cope with this problem by applying the procedure described in the 
proof of Lemma not only to the configuration S, but to all the configurations that can 
be obtained by extending S with one or two additional actors belonging to one of the finite 
classes of the considered program. In fact, at most two actors are modified by one transition. 
Each of these additional actors executes a process obtained by applying a renaming p to a 
suffix of one of the method definitions of the corresponding class. As observed above, there 
are finitely many processes that can be obtained up-to ~,. Finally, the additional actors 
have a queue including at most one method invocation (in fact, at most one message can 
be consumed in one transition). Also in this case, by considering the method definitions of 
the actor class, it is easy to see that there are finitely many different method invocations 
up-to ~a. 

'The second extension is trivial and deals with the fact that in the abstract semantics 
a method invocations can be introduced in the queue of any of the actors belonging to the 
same class of the expected target actor. So the procedure of the proof of Lemma [4.6] for 
computing X must be extended to consider also this kind of transitions. L] 


From Theorem this last Lemma and the results on well-structured transition sys- 
tems recalled at the beginning of Section[4] we can conclude that also control-state reachabil- 
ity, besides termination as already commented above, is decidable for the abstract semantics. 
From Proposition [5.1] we have already concluded that the abstract semantics preserves ter- 
mination and control-state reachability w.r.t. the concrete semantics. Hence, we have that 
termination and control-state reachability are decidable for stateless actor program. 

'The decidability of control-state reachability entails the decidability of process reacha- 
bility. In fact, given a process P, the reachability of a configuration A > (P’,y,q),S with 
P' equal to P up-to renaming of variables and actor names can be solved in the abstract 
transition system simply by checking the control-state reachability of at least one of the 


following states. Let C4,...,C, be the actor classes of the considered actor system and let 
A1,::: , An be such that A; € Ci. We consider the following finite set of states: 
S = {A;>(Qi,2,¢) | 1X in, Qiisa suffix of a method definition 


in the class C; and it is equal to P up-to renaming } 
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6. CONCLUSIONS 


To the best of our knowledge this paper contains a first systematic study on the computa- 
tional power of Actor-based languages. We have focussed on the pure asynchronous FIFO 
queueing and dequeuing of method calls between actors in the context of a nominal calcu- 
lus which features the dynamic creation of variable names that can be passed around. The 
results proved in this paper can be summarized as follows: 


e we identified two small but Turing powerful fragments of our Actor language: the fragment 
in which only boundedly many actors can be created, and the fragment in which fields 
cannot be updated; 

e we have proved that the fragment obtained as intersection of the two above sublanguages 
is not Turing complete, as properties like termination and control-state reachability turn 
out to be decidable; 

e if Actors are stateless, the language has decidable termination and control-state reacha- 
bility even if we consider unboundedly many Actors. 


We conclude by mentioning relevant lines for future research. Recent work have identified 
more expressive Actor interaction mechanisms based an asynchronous method calls imple- 
mented by means of the so-called future variables [14]: we plan to investigate the impact of 
this Actor-based synchronization mechanism on our (un)decidability results. We also plan 
to extend our study of expressiveness to primitives like the release statements in [7]. These 
statements support the so-called cooperative shceduling of method invocations: method 
executions can release the control of the Actor in such a way that other method executions 
can be instantiated or resumed. 
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